1

I was wondering if there were any drawbacks to using Options -Indexes in my WordPress htaccess file to block access to directories such as uploads, etc.

Wpbeginner has a post on it here

3
  • Strictly speaking, Options -Indexes doesn't "block access", it prevents directory listings being auto-generated when there is no DirectoryIndex document in that directory. Files in that directory can still be accessed and indexed if they are discovered by some other means.
    – MrWhite
    May 31, 2017 at 9:37
  • I've also added the directory to my robots.txt file to block robots. I know the files are still accessible but at least they are not indexed. Do you have any recommendation to further secure these directories?
    – brandozz
    May 31, 2017 at 14:25
  • I think robots.txt is sufficient, providing the files are not sensitive (which would require some kind of authentication). Another alternative (instead of robots.txt) to prevent indexing would be to send the X-Robots-Tag: noindex HTTP response header in response to such requests. Since robots.txt prevents crawling, it doesn't necessarily prevent indexing, if the document gets publicly linked to. However, it may be preferable to prevent unnecessary crawling in this instance.
    – MrWhite
    May 31, 2017 at 15:21

1 Answer 1

1

There are some legitimate use cases for enabling Indexes but they're probably not applicable to most sites (especially WordPress sites).

For example Indexes are helpful on file storage mirrors where you want to provide readonly access to a subset of folders & files without having to build your own UI.

As a best practice, yes, disable them globally using Options -Indexes.

1
  • Thanks for the feedback. I'm currently using the Job Manger plugin which allows users to upload their resumes to our site. The file that they upload goes into the public uploads directory. Currently those files are accessible while also being indexed.
    – brandozz
    May 30, 2017 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.